// Both oidc and oauth headers cannot be set
func validateAuthHeaders(_ context.Context, diff *schema.ResourceDiff, v interface{}) error {
    httpBlock := diff.Get("http_target.0").(map[string]interface{})

    if httpBlock != nil {
        oauth := httpBlock["oauth_token"]
        oidc := httpBlock["oidc_token"]

        if oauth != nil && oidc != nil {
            if len(oidc.([]interface{})) > 0 && len(oauth.([]interface{})) > 0 {
                return fmt.Errorf("Error in http_target: only one of oauth_token or oidc_token can be specified, but not both.")
            }
        }
    }

    return nil
}



func authHeaderDiffSuppress(k, old, new string, d *schema.ResourceData) bool {
    // If generating an `oauth_token` and `scope` is not provided in the configuration,
    // the default "https://www.googleapis.com/auth/cloud-platform" scope will be used.
    // Similarly, if generating an `oidc_token` and `audience` is not provided in the
    // configuration, the URI specified in target will be used. Although not in the 
    // configuration, in both cases the default is returned in the object, but is not in.
    // state. We suppress the diff if the values are these defaults but are not stored in state.

    b := strings.Split(k, ".")
    if b[0] == "http_target" && len(b) > 4 {
        block := b[2]
        attr := b[4]

        if block == "oauth_token" && attr == "scope" {
            if old == canonicalizeServiceScope("cloud-platform") && new == "" {
                return true
            }
        }

        if block == "oidc_token" && attr == "audience" {
            uri := d.Get(strings.Join(b[0:2], ".")+".uri")
            if old == uri && new == "" {
                return true
            }
        }

    }

    return false
}

func validateHttpHeaders() schema.SchemaValidateFunc {
	return func(i interface{}, k string) (s []string, es []error) {
		headers := i.(map[string]interface{})
		if _, ok := headers["Content-Length"]; ok {
			es = append(es, fmt.Errorf("Cannot set the Content-Length header on %s", k))
			return
		}
		r := regexp.MustCompile(`(X-Google-|X-AppEngine-).*`)
		for key, _ := range headers {
			if r.MatchString(key) {
				es = append(es, fmt.Errorf("Cannot set the %s header on %s", key, k))
				return
			}
		}

		return
	}
}
